Dynamic VirtualCredit Card Numbers

Ian Molloy, Jiangtao Li, and Ninghui Li

John Doe 678

Card Issuer

Account Number

Luhn Check Code

Card Verification Value

Expiration Date

Dynamic Virtual Credit Card Numbers• Calculate Keyed MAC of transaction• Use MAC in place of account number• Card Issuer can verify the MAC• Binds the merchant, date and amount to the account number• Stolen card numbers loose their value• Don't need to trust the merchant

MAC

Transaction Parameters• Expiration Date• Merchant• Amount• Billing Address

Shared Secrets• Account Number• Password

k = SHA1(Account||Password)V = HMACk(Transaction)

Implementation• Java 2 MicroEdition MIDlet 2.0• Runs on everyone's favorite ubiquitous computing device: mobile phones

CERIAS CREDIT CARD

0123 4567 8901 234502/07

John Doe

Not Valid Unless Signed. Don't bother writing "Ask for ID," no one ever does.

For further details, see our paper in the Eleventh International Conference on Financial Cryptography and Data Security 2007

CERIAS CREDIT CARD

0123 45XX XXXX XXXC02/07

John Doe

Account & CVV

Credit Card Numbers get Stolen• Laptop with credit card info for 80,000 DOJ workers stolen March 31, 2005• Hotels.com Credit-Card Numbers Stolen June 2, 2006• Amazon Unit Loses Credit Card Data to Hackers March 6, 2001• 40 Million Credit Card Numbers Hacked June 18, 2005

Previous Work• Microsoft Patent 5883810 Transaction-proxy Numbers • Implemented by Orbiscom for Discover, CitiBank, MBNA, and PayPal • Requires Card Issuer to generate new account number

Security• Complete • Can always generate an account number• Sound • Can always identify the correct account• Secure Against Forgery • No VCC numbers can be forged• Secure Against Account Recovery • No adversary can gain the actual account number

Miscellaneous• We can create multi-use numbers• Unaffected by collisions in the account space• Can handle collisions from AVS

Can we do this offline?

What's the problem? Why do we send our actual account number?

496-BB6.pdf 1 3/1/2007 3:16:22 PM